At the time of writing Sophos has received no reports from users
affected by this worm. However, we have issued this advisory
following enquiries to our support department from customers.

Description:

W32/Fishlet-A is an internet worm that spreads via email by
sending itself to email addresses found in the Windows address
book.

The email will have the following characteristics:
Sender's address: eMarket Services
Recipient: e-Market customer
Subject line: Order report
Message body:
The body of the email starts with the following lines:

"Dear eBay customer,

Thank you for using eBay services.
_____________________________
Your order Num. is: 31547
Delivery time: 7 days

When this file is run an eBay advertisement is displayed. The
worm copies itself into the Windows folder as ssh261.exe. It
also drops the files fishlet.bin, SndVx.exe and ccfp.exe into
the same folder. The worm sets the following registry entry so
that it will be automatically started when Windows starts up: